Added note about SocketIO authorization with custom handlers.

I found it pretty confusing and magical why sessions work working properly since we wanted all our SocketIO sessions to be validated by passport except for the login page.

I dont see this as being a bug but at least some notation in the docs are necessary.

I included my handler in the documentation but that could be simplified to the 3 lines that actually set the session or maybe even moved to its own example along with the session example I believe people would find it there.

If you need me to write up an example with it I would be happy to.